Unauthenticated Privilege Escalation in Pods for WordPress

This two-file repository contains one Python 3 exploit program (`CVE-2026-19598.py`) and a README. It is a standalone, requests-based bulk exploitation utility rather than a Metasploit, Nuclei, or other framework module. The script normalizes target URLs, loads multiple targets from a file, probes public Pods plugin paths, extracts a version from `readme.txt` or `init.php`, and considers unknown versions potentially vulnerable. It uses a thread pool for mass scanning/exploitation, randomizes user-agent strings, disables TLS-certificate warnings/verification, prints progress/status output, and persists successful credentials. The documented attack abuses the Pods `pods_admin` AJAX action with `save_user` and `meta-box-loader=1` to create an administrator or overwrite a user password, followed by login verification. The code and README describe an active account-compromise exploit, not merely a vulnerability detector.

This repository is a small standalone Python proof-of-concept for CVE-2026-19598 targeting the WordPress Pods plugin (<= 3.3.9). It contains two files: a README describing the issue and one executable script, CVE-2026-19598.py, which is the main exploit entry point. The exploit is not a scanner or detection-only tool; it performs active exploitation. Its core capability is unauthenticated privilege escalation against a vulnerable WordPress site by sending a crafted request to /wp-admin/admin-ajax.php. The request uses the Pods AJAX action pods_admin with method save_user to modify user ID 1, setting a randomly generated email address and password and assigning the administrator role. This effectively attempts to take over or repurpose the primary WordPress account. After exploitation, the script performs post-exploitation verification by requesting /wp-login.php, optionally extracting a _wpnonce from the login page, submitting the generated credentials, and then checking /wp-admin/ for dashboard content to confirm successful administrator access. The script normalizes target URLs, uses aiohttp for asynchronous HTTP requests, disables SSL verification, and presents status output with the rich library. Repository structure is minimal and purpose-built: README.md documents the vulnerability and intended research-only use, while CVE-2026-19598.py contains helper routines for password/email generation, nonce extraction, login verification, and the single-site exploitation workflow. The exploit appears operational rather than merely demonstrative because it includes a complete exploitation path and credential verification logic, but it is still a simple standalone PoC rather than a framework-integrated or highly customizable weaponized tool.

This repository contains a single Python script, masscan.py, which functions as a multithreaded mass-exploitation tool rather than a benign detector. It reads a list of target base URLs from a user-supplied file, appends /wp-admin/admin-ajax.php to each target, and sends a crafted POST request intended to abuse a WordPress/Pods administrative AJAX action. The request uses action=pods_admin and method=save_user and supplies hardcoded account details to create a new administrator user: username admin_test, password P@ssw0rd123!, and email admin_test@test.com. The script treats HTTP 200 responses containing user_id or success as evidence of successful exploitation. Structurally, the code has two main functions: exploit_single(), which performs the HTTP POST and evaluates the response, and main(), which handles user input, file loading, concurrent execution with ThreadPoolExecutor(max_workers=10), console reporting, and writing successful targets to vulnerable.txt. There is no framework usage, no modularization, and no payload customization beyond editing the script. The exploit capability is unauthorized admin account creation on vulnerable WordPress targets, making this an operational web exploit with mass-scanning support.